Industry executives and experts share their predictions for 2021. Read them in this 13th annual VMblog.com series exclusive.
Weathering the cybersecurity storm with agility and awareness
Contributed by Synopsys executives
As we close out a tumultuous year on all fronts, malicious actors continue to strengthen their tactics. Because of this, it’s important that organizations position themselves to “weather the cybersecurity storm” as we look ahead to 2021, remaining agile, aware and active in their cybersecurity approach. Below, Synopsys thought leaders outline their expectations for the year ahead, including the embrace of new security-driven concepts, knowledge building as attacks run rampant and vulnerabilities remain, and the adoption of new tools to support software security practices within organizations of all shapes and sizes.
Asma Zubair, Senior Manager of IAST Product Management
The global pandemic has dramatically increased online interactions and digital transactions. It has also dramatically expanded the overall attack surfaces of organizations to cyberattack. While the advanced warning for most organizations to prepare was little to none, in order to weather the storm, businesses must transform their processes, services, and technologies to meet customer expectations. They must be nimble without compromising the security and privacy of their organizational and customer data as well.
As a result of this, I expect that more and more organizations will embrace concepts such as DevSecOps and interactive application security testing (IAST) in the coming months. DevSecOps describes an organizational culture whereby software development, testing and deployment practices compress the release cycle and deliver software continuously. IAST is an agent-based technology that detects vulnerabilities in web applications. Because IAST monitors data flow, logic and values in memory to report application security vulnerabilities during functional testing, it yields very accurate results and doesn’t require application or source code scanning. Therefore, it doesn’t slow down the pipeline. Due to its accuracy and speed, IAST suits the DevSecOps process. This method of testing also offers full context around vulnerabilities, making it easy for developers to reproduce and remediate them.
Jonathan Knudsen, Senior Security Strategist
Some things will certainly not change in 2021. Massive amounts of valuable data will continue to be placed online in public places with no protections. Organizations will continue to not keep up to date with software patches and versions. People will continue to use the same weak passwords across multiple accounts. Folks will continue to click on unsafe email links. Organizations will continue to ignore accumulated wisdom about defense in depth and lessons about software development that organizations have learned the hard way.
In 2020 we saw attacks on unlikely-seeming targets. Looking ahead, attackers will continue to profit from the asymmetric advantage of software exploits, delivering punishing attacks on organizations of all types, including unlikely targets like those that we saw in 2020.
Thomas Richards, Principal Consultant
For the past several years, social engineering has been the primary attack vector used to breach organizations. While we have seen organizations implement increasingly rigorous social engineering testing programs to increase awareness and lower the chances of a successful attack, humans will continue to be a popular target for cyber-criminals. Ransomware attacks will most likely continue to cause havoc for companies as the attackers get more sophisticated in their approach.
Meera Rao, Sr. Director of Product Management (DevOps Solutions)
Over the past year, we’ve seen organizations rapidly building applications using low- and no-code platforms. In 2021, there will be an increased focus on building out low-code/no-code options for application security, and ultimately building security into the DevOps process.
I also envision a change in how we build security into software. More and more AST tools will move towards providing the same experience as low- and no-code platforms.
##
